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Iftiiveisily at Buffalo 

Clinical Legal Education 

School of Law 
December 5, 2018 

Director, Office of lnl'omialion Policy 
U.S. Deparlmcnt of Justice 
Suite 11050 

1425 New York Avenue, NW 
Wasliinj*ton, DC 20528-0001 

R£: Appeal of FOIA Response 

Frcetloiii of Inforiiiatioii Act/ Privacy Act Request 18-OIG-505 

Dear Sir or Madam: 

We write on behalf of the co-requestors Privacy International (“PT”), the American 
Civil Liberties Union and the American Civil Liberties Union Foundation (together, the 
“ACLU”), and the Civil Liberties and Transparency Clinic of the University at Buffalo 
School of Law (“CLTC”), to appeal your agency’s September 28, 2018 response to our 
September 10, 2018 request for documents and information pursuant to the Freedom of 
Information Act. We appeal on the grounds that your agency performed an inadequate 
search as is required by the Act and failed to produce records responsive to the request. 

I. Backaroiind 

By letter dated September 10,2018, PI, A( ’I .,U, aiul CI TC’ requested from the U.S. 
Department of Justice’s Office of Inspector (ieneral (“DOJ-Ol( i”) copies of records related 
to investigations or audits into the use of computer hacking tools by law enforcement agents. 
The FOIA rcqucsl (allached hereto as Bxhibit A) sought two categories of records— Lc. 
DOJ-OK l rc|X)rls regaixling govcriinicnl use of hacking tools as well as records upon which 
DOJ-OK I relied in preparing any such reports, '[’he request also sought expedited processing 
under 5 U.S.C. § 552(a)(6)(E) and a fee waiver or limitation of fees. 

As of today, we have received one leller in response to our re(|uest to the DOJ-OIG 
(attached hereto as Exhibit B). This lettci' from (jovernment Information Specialist Jeanetta 
M. Howard of the Office of General Counsel, dated September 28,2018, acknowledged 
receipt of our request and responded to our rcc|ucsl by disclosing three publicly available 
OIG reports. Interestingly, this included one report that we hatl already referenced in our 
initial FOIA request as supporting evidence for the need for more information on the use of 
hacking tools by the gt)vernmcnl. Wc believe this response is insufficient bccaase the search 
for records was inadec|uate and because the agency failed to identify rectirds clearly 
responsive to the request. Accordingly, pursuant to the Department of Justice regulations, 28 
C.F.R. § 16.8(a), we hereby timely appeal the DO.I-OIG’s response to our FOIA request. 


507 O’Brian Hall, Buffalo. NY 14260-1100 
716.645.6222 (F) 716 645-2167 
jmmanes@buffa!o.edu 


www.buffalo.edu 




Case l:18-cv-01488 Document 1-20 Filed 12/21/18 Page 3 of 5 


II. Basis for Appeal 

DOJ-OIG is requircti by law and rcgulalion (o coiulucl a Ihoiougli search for records 
rcsjJonsivc to a 1^01 A request. A search under FOIA “means to review, manually or by 
automated means, agency records for the purpose of locating those recortLs which arc 
responsive to a request.” .S IJ.S.C. § .S.52(a)(3)(l)). Moreover, under .S U..S.C. § .S52(a)(3)(C), 
an agency sliall make reasonable efforts to scjireh for records in electronic fonn or format 
that may be responsive to the request, with an exception tor when such elfbrts signilicantly 
intcricre with (he agency’s automated iiiforination system. 

DOJ-OIG failed to comply with these obligations. By merely referring us to three 
publicly available reports and failing to describe the manner in which it conducted its 
search, the DOJ-OIG has tailed to demonstrate (hat it made rc:isonablc efforts to search t()r 
the lirst category of records sought— i.e. reports or similar documents relating to oversight 
of goveniment use of hacking tccluu(|ues. Moreover, DOJ-OIG has, apparently, completely 
ignorcti the secotui item of our request, which sought “any records that the DOJ-OIG relied 
upon in the course of preparing reports or other documents responsive to |the first category 
of the requestj.” See F,x. A. DOJ-OKi appears to liave failed to search for or identify any 
such records, even with respect to the three reports that it identified as responsive to the 
request. 


It is well established that when an agency receives a FOIA request, it mu.st conduct a 
search reasonably calculated to uncoverall relevant documents. See Ctr.for liiotogical 
Diversity v. Office of the United States Trade Representative, 450 F. App’x 605 (9th C!ir. 
2010). Tins .search does not need to be perfect, but the agency must demonstrate that its 
search was adequate in order to meet its burden. See Rein v. United State PTO, 55.3 F.3d 353 
(4th Cir. 2009). Adequacy is measured by the reasonableness of the effort in light of the 
specific request. See id. (quoting Meeropol v. Meese, 790 F.2d 942 (D.C. Cir. 1986)). In 
demonstrating the adequacy of its search, an agency may, with reasonable detail, set forth 
the search terms and types of searches performed and aver that all files likely to contain 
responsive material were searched so as to give the requesting party an opportunity to 
challenge the adequacy of the search. See Rein at 362; also Ethyl Corp. v. United States 
EPA, 25 F.3d 1241, 1250 (4th C-ir. 1994). Fuither, an agency can demonstrate a search was 
adequate by providing “specific information regarding what files were .searched ... why 
fuither searches arc unlikely to produce additional record.s, or why additional .searches are 
impractical.” Ctr. for Biological Diversity, 450 F. App’x at 608. 


The DOJ-OKi’s .search for records was inadequate for at least three reasons. Eirst, it 
has failed to demonstrate how its .search for records w;ls reasonable. DOJ-OIG stated tliat it 
found three publicly available reports that may be responsive to our request. One of these 
reports, involving the San Bernardino terrorist attack, was mentioned in our FOIA retpiest as 
evidence for the jniblic interest in di.sclosure and the need for expetlitcd processing. The 
other two reports are likewise publicly available. DOJ-OIG’s search thus apparently did not 
go beyond a review of publicly-available documents already readily accessible to us on 
DOJ-OIG’s website. This is by no means an adequate search within the meaning of FOIA. 
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There is good reason (o believe dial additional DOJ-OIG reports exist concerning 
use ol‘government hacking techniques by law enforcement agencies within the Department 
of Justice. Components of DOJ, including the I'BI luid DEA, have deployed hacking tools 
extensively. In a number of instances, there has been significant public controversy about 
whether the goveniment’s use of such techniques was lawful or whether govenuneiit agents 
complied with internal agency policy and rules. For example, the FBI used hacking 
techniques to impersonate a journalist and deploy malware onto the computer of a high 
school student who was accused of making bomb threats. Similarly, the FBI secretly used 
malware to ideiilify unsuspecting users on the servers of Freedom Hosting, an anonymous 
website liosting sei viee. (liven these high-prollle and extensively reported uses oJ" 
hacking—and the legal and policy questions they raised—^there is good reason to believe 
that DOJ-OIG has conducted additional oversight activity on the use of hacking 
techniipies—beyond the three public reports identilied already—and that DOJ-OIG has 
additional reports, memoranda, or similar documents that are responsive to our request. 

Second, DOJ-OIG appeal’s to have failed to eonducl any search at all for records 
responsive to the second item in our request. As noted alreaily, that portion of our request 
sought any records upon which DOJ-OIG relied in preparing rqiorts coneerning goveniment 
hacking tcchnic|ues. DOJ-OIG has already identified three such reports, yet it has failed to 
identify even a single recorilupon which it relied in preparing those reports. DOJ-OlG’s 
response gives no indication whatsoever that it searched for such records. Indeed, it is 
utterly implausible that DOJ-OIG has no records in its possession underlying the extensive, 
public reports that it has publishetl concerning government use of haeking teehniques. DOJ- 
OIG’s response to the request is thus plainly incomplete. 

Finally, DOJ-OIG failed to include any infomiation about how it conducted its 
searches, such as which oflices were searched, what databases were searchetl, what search 
terms were used, or how particular personnel went about identifying responsive records. 
DOJ-OIG has likewise offered no reason to believe that additional, reasonable searches 
would be unlikely to produce more reeords. Without providing more inlbrmation about the 
nature of the searches pei fonncd, DOJ-OIG has failed to establish that its elforls in 
conducting the search were in compliance with its obligation under FOIA. To the contrary, 
there is every reastm to believe those elforts were inadequate. 

Having failed to meet its burden under FOIA, we respectfully request that the DOJ- 
OIG conduct additional searches for records in compliance with the requirements of FOIA. 

HI. Request for Relief 

For the foregoing reasons, we submit that DOJ-OIG failed to make a reasonable 
effort to search for records in violation of FOIA. We respectfully request that you grant this 
appeal arul direct DOJ-OIG to conduct additional searches by making a reasonable efhirt to 
search for all responsive records, and to begin processing the requested records inimcdiatcly 
for potential release. 
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Please direct all correspondence relating to tliis rec|ue.st to: 
Jonathan Manes 

Civil l iberties & rrausparency Clinic 
University at Liu Halo School of Law 
507 O’Hrian Hall, North Cainpns 
Bunalo,NY 14260-1100 
(716)645-6222 
iinmanes@buffalo.edu 

Thank you for your prompt attention to this matter. 


Brett Max Kaufman 
Vei-.i Ridciman 

American C’ivil Liberties Union 
Roundalion 

125 Broad Street, ISth Floor 
New York, NY 10004 
bkaufnian@aclu.org 
veidelman@aclu.org 


Sincerely, 

.lona/lian Manes, supervishig^alUmiey 
Alex Belschcn, student attorney 
RJ McDonald, student attorney 
Colton Kells, student attorney 
Civil Liberties and Transparency Clinic 
University at Buffalo School of Law, SUNY 
507 O’Brian Hall, North (!atupus 
Buffalo, NY 14260-1100 
Tel: 716.645.6222 
Jmmanes@buffalo.edu 


Jennifer Stisa Granick 

American Civil Liberties Union 

Foundation 

39 Dniinm Street 

San Franciseo, ('A 94111 

Tel: 415.343.0758 

jgranick@aclu.org 


Scarlet Kim 

Privacy International 

62 Britton Street 

Loiulou OC.’I M 5UY 

United Kingdom 

I el: +44 (0)203 422 4321 

scarlet@privacyintemational.org 
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